
Passwords should never be seen in clear text eg. in transfer objects, or in database columns. So we hash them up. Nothing to it.

<a style='text-decoration: none; color: black;' href="https://code.google.com/p/vellum/wiki/Enigma">
<div style="border-bottom: solid 1px; background-color: #ccff00; font-weight: bold;">
<img src="http://weblogs.java.net/blog/evanx/archive/database.png" border="0" width="32" height="32" align="left" hspace="8"/><b>Read "Password Hash, a short story"</b> <i>Part of the "Jelly Beans" part of a trilogy in 42 parts</i>
https://code.google.com/p/vellum/wiki/PasswordHash
</div>
</a>

WARNING: This is an old defunct article (from February 2007) that doesn't include salt! It has been superceded by <a href="https://code.google.com/p/vellum/wiki/PasswordHash">https://code.google.com/p/vellum/wiki/PasswordSalt</a> (published December 2012).

<h2>Code Snippet</h2>

<pre>
public class PasswordHasher {
    String algorithm = "SHA-256";
    
    public String hashPassword(byte[] passwordBytes) 
    throws NoSuchAlgorithmException {
        MessageDigest digest = MessageDigest.getInstance(algorithm);
        byte[] hashBytes = digest.digest(passwordBytes);
        String hashString = Base64.encode(hashBytes);
        return hashString;
    }
    
    public boolean verifyPassword(byte[] passwordBytes, String hashString) 
    throws NoSuchAlgorithmException {
        return hashPassword(passwordBytes).equals(hashString);
    }
}
</pre>